How OpenCodeReview Integrates with CI/CD Pipelines: A Complete Technical Guide

OpenCodeReview integrates with CI/CD pipelines as a deterministic CLI tool that executes automated code reviews via JSON output, enabling platform-native comment posting across GitHub Actions, GitLab CI, and Bitbucket Pipelines.

OpenCodeReview (OCR) from Alibaba is architected specifically for seamless CI/CD integration, functioning as a portable Node.js CLI that runs inside any CI runner. Unlike webhook-based solutions, OCR performs deterministic file bundling and rule resolution before invoking LLMs, ensuring reproducible reviews across pipeline executions. This article explains exactly how open-code-review integrates with CI/CD pipelines using real configuration files and posting scripts from the alibaba/open-code-review repository.

Core Architecture for CI/CD Execution

Deterministic Review Scope

Before any LLM call occurs, OCR executes a deterministic engineering phase to guarantee reproducible results. The CLI calculates the exact review scope using git merge-base combined with the head SHA to identify the precise set of changed files. This approach ensures that every pipeline run inspects identical file sets regardless of timing or runner state, bundling related files and resolving rule-matching deterministically as documented in pages/src/content/docs/zh/architecture.md.

CLI-Driven JSON Workflow

The central integration pattern relies on executing ocr review … --format json within the CI runner. This command streams the Git diff to the configured LLM provider and returns a structured JSON payload containing line-level comments, code suggestions, and severity metadata. The deterministic output format allows platform-specific scripts to parse results and post comments via native REST APIs.

Platform-Specific Integration Patterns

GitHub Actions Integration

For GitHub repositories, OCR ships as a composite action defined in action.yml. The workflow invokes scripts/github-actions/post-review-comments.js to parse the JSON output and create inline comments using the GitHub Pull-Request Review API. The script handles sticky summary comments and incremental review modes, anchoring feedback to specific lines when possible while maintaining idempotency.

GitLab CI Integration

GitLab pipelines utilize the same CLI binary with a Python wrapper located at examples/gitlab_ci/post_review.py. This script translates OCR's JSON output into GitLab Discussions API calls, creating Merge Request discussions with proper threading. The integration reads CI_MERGE_REQUEST_TARGET_BRANCH_NAME and CI_COMMIT_SHA environment variables to establish the diff range.

Bitbucket Pipelines Integration

Bitbucket Cloud implementations follow an identical pattern using Node.js scripts (referenced in examples/bitbucket_pipelines/README.md) to interface with the Bitbucket Pull-Request Comments API. The pipeline triggers on pull request events, executing ocr review with --from and --to parameters pointing to the destination branch and current commit.

Configuration and Security Model

All sensitive configuration flows through CI secrets mapped to environment variables. OCR reads OCR_LLM_URL, OCR_LLM_AUTH_TOKEN, and platform-specific tokens (GITHUB_TOKEN, GITLAB_API_TOKEN, BITBUCKET_ACCESS_TOKEN) from the runner environment. This design prevents credential exposure in logs while allowing seamless secret rotation through native CI/CD secret management systems.

Idempotency and Rate Limit Handling

Before posting any comments, OCR queries existing reviews to prevent duplicate feedback on subsequent pipeline runs. The platform-specific scripts respect rate-limit headers including retry-after and x-ratelimit-remaining, implementing exponential back-off strategies with configurable environment variables as detailed in examples/github_actions/README.md.

Customization and Advanced Flags

The CI/CD integration exposes extensive customization through command-line flags and action inputs:

• review_concurrency / --concurrency – Controls parallel LLM request limits
• --background – Injects PR/MR titles or descriptions as context for the review
• --rule – Specifies custom rule files for project-specific linting
• sticky_summary – Maintains a single updatable summary comment vs. multiple posts
• incremental – Posts only new findings compared to previous reviews

Practical Implementation Examples

GitHub Actions Workflow

name: OCR PR Review
on:
  pull_request_target:
    types: [opened, synchronize, reopened]
  issue_comment:
    types: [created]

jobs:
  code-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: alibaba/open-code-review@main
        with:
          llm_url: ${{ secrets.OCR_LLM_URL }}
          llm_auth_token: ${{ secrets.OCR_LLM_AUTH_TOKEN }}
          llm_model: ${{ vars.OCR_LLM_MODEL }}
          llm_use_anthropic: ${{ vars.OCR_LLM_USE_ANTHROPIC }}
          sticky_summary: 'true'
          incremental: 'true'
          review_concurrency: 5

GitLab CI Configuration

image: node:20
variables:
  OCR_LLM_URL: $OCR_LLM_URL
  OCR_LLM_AUTH_TOKEN: $OCR_LLM_AUTH_TOKEN
  OCR_LLM_MODEL: $OCR_LLM_MODEL
  GITLAB_API_TOKEN: $GITLAB_API_TOKEN

stages:
  - review

ocr_review:
  stage: review
  script:
    - npm install -g @alibaba-group/open-code-review
    - ocr config set llm.url "$OCR_LLM_URL"
    - ocr config set llm.auth_token "$OCR_LLM_AUTH_TOKEN"
    - ocr config set llm.model "$OCR_LLM_MODEL"
    - ocr review --from origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME \
        --to $CI_COMMIT_SHA \
        --format json \
        --background "$CI_MERGE_REQUEST_TITLE"
    - python3 post_review.py /tmp/ocr-result.json

Bitbucket Pipelines Setup

image: node:20
pipelines:
  custom:
    ocr-pr-review:
      - step:
          name: OpenCodeReview PR Review
          script:
            - npm install -g @alibaba-group/open-code-review
            - ocr config set llm.url "$OCR_LLM_URL"
            - ocr config set llm.auth_token "$OCR_LLM_AUTH_TOKEN"
            - ocr config set llm.model "$OCR_LLM_MODEL"
            - ocr review --from "origin/${BITBUCKET_PR_DESTINATION_BRANCH}" \
                --to "${BITBUCKET_COMMIT}" \
                --format json \
                --background "${BITBUCKET_PR_TITLE}"
            - node post_review.js /tmp/ocr-result.json
triggers:
  pullrequest-push:
    - condition: BITBUCKET_PR_DESTINATION_BRANCH == "main"
      pipelines:
        - ocr-pr-review

Summary

• Portable CLI Architecture: OpenCodeReview runs as a Node.js ≥ 24 binary in any CI/CD environment, requiring only shell access and Git history.
• Deterministic Scope Calculation: Uses git merge-base and head SHA comparisons to ensure identical review boundaries across pipeline reruns.
• JSON-Based Integration: The --format json output enables universal parsing by platform-specific posting scripts for GitHub, GitLab, and Bitbucket.
• Native API Posting: Comments are created via official REST APIs (GitHub Pull-Request Review API, GitLab Discussions API, Bitbucket Comments API) with line-level anchoring.
• Idempotent Execution: Built-in duplicate detection and rate-limit handling prevent comment spam and API throttling issues.
• Secret-Driven Configuration: All authentication flows through standard CI secret mechanisms using OCR_* and platform-specific token environment variables.

Frequently Asked Questions

Which CI/CD platforms does OpenCodeReview support?

OpenCodeReview supports any CI/CD platform capable of running Node.js ≥ 24, including GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins, CircleCI, and Azure DevOps. The repository provides ready-made examples for GitHub Actions (action.yml), GitLab CI (examples/gitlab_ci/), and Bitbucket Pipelines (examples/bitbucket_pipelines/), while other platforms can invoke the ocr review CLI directly using the same JSON output pattern.

How does OpenCodeReview prevent duplicate comments in CI pipelines?

Before posting new feedback, OCR queries existing reviews through platform APIs to check for previously submitted comments. The system implements idempotency checks in scripts like scripts/github-actions/post-review-comments.js, ensuring that only new findings appear while existing comments remain untouched. The incremental mode further refines this by comparing current results against previous pipeline runs.

What security measures protect LLM API keys in CI/CD environments?

All sensitive credentials—including OCR_LLM_URL, OCR_LLM_AUTH_TOKEN, and platform tokens like GITHUB_TOKEN—are consumed exclusively through environment variables injected by the CI system's secret management. The CLI never logs these values, and the composite GitHub Action masks secrets in workflow outputs. This approach aligns with standard CI security practices while avoiding credential exposure in repository code or runner logs.

Can I customize review rules and concurrency in pipeline executions?

Yes, the CI integration exposes multiple customization points through command-line flags and action inputs. You can specify custom rule files with --rule, adjust parallel processing via --concurrency or review_concurrency, inject contextual background with --background, and control comment behavior using sticky_summary or incremental modes. These settings are passed directly to the ocr review command within your pipeline configuration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}